About thulasikrishnan

thulasikrishnan · ‎09-20-2019

Thanks! Appreciate all your help @kamlesh_vaghela . Have a good weekend ahead!

thulasikrishnan · ‎09-18-2019

This looks like its doing its job. This is good! I have accepted the answer. thanks @kamlesh_vaghela Now I am gonna have to try to figure how it scales i.e. when there are 100s of failed sessionIds and I only need to take 5 or 10 sample values (for users to troubleshoot) in the failed_sessionIds field. If you have ideas on how to achieve that on top of this solution, appreciate if you could give it a shot. But this is good enough too.

thulasikrishnan · ‎09-17-2019

I am trying to work a set of data that looks like this: I want to display it like so: My problem is getting the mv list of failed sessionIds. I wish we had something like stats count(eval(status_code=200)) as success_count values(sessionId(eval(where(status_code>200)))) as failed_sessionId by req_method Appreciate any suggestions to achieve this with reasonable simplicity.

thulasikrishnan · ‎09-04-2019

Alright so this seems to be a known issue addressed in this page: https://answers.splunk.com/answers/505978/why-is-setting-a-token-from-result-not-working.html TLDR - $result.field$ token works only when you use <finalized> . Replace <done> with <finalized> in the Accepted Answer code snippet and it works in case you encounter problems with older versions.

thulasikrishnan · ‎09-04-2019

Ok so this doesn't work on 6.2.x or lesser which do not have <done> or <finalized> . I am trying this in 6.3.0 now. I somehow encounter a strange issue where below snippet ``` <set token="tokFromDate">$result.fromDate$</set> <set token="tokToDate">$result.toDate$</set> `` doesn't assign the result of the makeresults query but instead assign the value as $result.fromDate$` instead of the value in this result token which is strange! btw I already upvoted the answer as it is correct.

thulasikrishnan · ‎09-03-2019

you saved my day

thulasikrishnan · ‎08-29-2019

partial=f ftw!

thulasikrishnan · ‎08-07-2019

@niketnilay this is an excellent answer. you have brilliantly collated scattered info and put it together in a usable way. Just a disclaimer though, there are still orgs that run ancient versions on Splunk (< 6.3) that do not have the done tag in XML. I'm not so much worried about having a default date appearing in the input field. But my problem right now is, in the absence of that default date assignment logic, I can't seem to bind the token with the date selection in the input field.

thulasikrishnan · ‎07-30-2019

Just a thought I had. If I get the relevant buckets with suitable time periods copied over from Dev to Prod, I should be able to achieve my goal. It is a standalone Splunk instance so I don't think the instance GUID is part of. I know the sysadmin is going to give me the looks. I also know this is not exactly the answer to my question. But just presenting it as a solve to achieve the end goal.

thulasikrishnan · ‎07-29-2019

I am a bit skeptical after reading the Splunk docs as the Production set up that I am dealing with is a standalone single instance deployment and not an indexer only instance. I don't know if making it a search peer to my Dev instance will impact its active prod SH duties.

thulasikrishnan · ‎07-29-2019

To comprehensively cover all use cases, I need at least 8 days worth of data. But the Dev is pooling license with prod. So I can't import that much logs into Dev without license violations.

thulasikrishnan · ‎07-29-2019

Hi I am doing a short term gig building dashboards in Splunk and I have a production standalone Splunk Enterprise single instance deployment which I don't have admin access to. But I do have admin access to the Dev instance. Dev instance however has no data in it. My gut tells me I can make the production instance a search peer to my Dev box and start using production data to build dashboards in Dev. But I see this in Splunk documentation Important: A search head should not perform a dual function as a search peer. The only exception to this rule is for the distributed management console, which functions as a "search head of search heads." I could not find anymore details whether this is a technical infeasibility or a performance best practice. Has anybody tried this before?

Posts	12
Solutions	0
Karma Given	8
Karma Received	1
Member Since	‎07-29-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Stats aggregation with potentially a eval-where cl...

Use standalone Splunk as a search peer

Re: Stats aggregation with potentially a eval-wher...

Re: Stats aggregation with potentially a eval-wher...

Stats aggregation with potentially a eval-where cl...

Re: Jquery datepicker in splunk

Re: Jquery datepicker in splunk

Re: Drilldown conditionally based on the value of ...

Re: Splunk Trend Indicator Single Value - Assistan...

Re: Jquery datepicker in splunk

Re: Use standalone Splunk as a search peer

Re: Use standalone Splunk as a search peer

Re: Use standalone Splunk as a search peer

Use standalone Splunk as a search peer